Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the capabilities of Microsoft EntraMedium
A company is migrating various legacy applications to Azure. These applications rely heavily on traditional LDAP and Kerberos authentication protocols and are not easily rewritable to use modern authentication methods. The company needs a managed service in Azure that provides domain controller functionality to support these applications without deploying and managing virtual machines for Active Directory. Which Microsoft Entra capability should they use?
- AMicrosoft Entra Domain Services
- BMicrosoft Entra Application Proxy
- CMicrosoft Entra ID Protection
- DMicrosoft Entra Connect
Show answer & explanationAnswer & explanation
Correct answer: A. Microsoft Entra Domain Services
Microsoft Entra Domain Services provides managed domain services, including LDAP and Kerberos authentication, that are fully compatible with traditional Active Directory. This allows legacy applications to run in Azure without changes, without the overhead of managing virtual machines for domain controllers.
Why the other options are wrong
- B. Microsoft Entra Application Proxy provides secure remote access to on-premises web applications, not domain services.
- C. Microsoft Entra ID Protection detects identity-based risks, which is unrelated to providing domain services for legacy applications.
- D. Microsoft Entra Connect synchronizes on-premises Active Directory with Microsoft Entra ID; it does not provide domain controller functionality in Azure.
Microsoft Entra Domain Services
Provides managed domain services in Azure, including domain join, LDAP, Kerberos, and NTLM authentication, compatible with traditional Windows Server Active Directory.
- Managed domain controllers for Azure workloads
- Supports legacy authentication protocols (LDAP, Kerberos, NTLM)
- No need to deploy/manage VMs for domain controllers
Memory trick: Domain Services: 'Old apps, New cloud home'.